EX294 Manage inventories and credentials — 10 Questions

Question 1

An administrator needs to store a secret API token in Ansible Automation Controller so that it can be used in job templates without exposing the token in plain text. Which type of credential should be used?

Accepted Answer

Machine credential. Option B is correct because a Machine credential in Ansible Automation Controller is designed to store SSH keys, passwords, and other authentication secrets for remote hosts. It can securely store an API token as a password field, which can then be referenced in job templates without exposing the token in plain text. This aligns with the requirement to store a secret API token for use in automation jobs.

Answer

Vault credential

Answer

Network credential

Answer

Cloud credential

Question 2

A team uses Ansible Automation Controller with multiple organizations. Each organization has its own set of machines that require different SSH keys. The administrator wants to ensure that users from one organization cannot use credentials from another organization. What is the best way to achieve this isolation?

Accepted Answer

Create credentials within each organization and assign organization-level access. In Ansible Automation Controller, credentials are scoped to organizations. By creating credentials within each organization and assigning organization-level access, the administrator ensures that credentials are only visible and usable by members of that organization. This leverages the built-in role-based access control (RBAC) that isolates resources by organization, preventing cross-organization credential access.

Answer

Store credentials in separate projects and restrict project access

Answer

Set 'Use' permission on credentials only for specific users

Answer

Place users in different teams and restrict credential access by team

Question 3

An Ansible playbook uses the `ansible_password` variable to connect to a Windows host. The value is stored in an encrypted Ansible Vault file. Which credential type in Automation Controller would allow the vault password to be supplied at runtime?

Accepted Answer

Vault credential. Option C is correct because Automation Controller's Vault credential type is specifically designed to provide the vault password needed to decrypt Ansible Vault-encrypted variables like `ansible_password`. When a job runs, the controller uses this credential to unlock the vault file, allowing the playbook to access the encrypted value at runtime without exposing the plaintext password.

Answer

Cloud credential

Answer

Machine credential

Answer

Network credential

Question 4

An administrator wants to create a custom credential type to store a third-party API key. The API key must be passed to the playbook as an environment variable `MY_API_KEY`. What is the correct Injector configuration in the custom credential type definition?

Accepted Answer

env: {MY_API_KEY: "{{ api_key }}"}. Option D is correct because the Injector configuration for a custom credential type in Ansible Automation Platform uses the `env` key to map credential inputs to environment variables. The syntax `env: {"MY_API_KEY": "{{ api_key }}"}` correctly references the input field `api_key` using Jinja2 templating and assigns it to the environment variable `MY_API_KEY`, which the playbook can then access via `ansible_env.MY_API_KEY`.

Answer

file: {MY_API_KEY: "{{ api_key }}"}

Answer

env: {"MY_API_KEY": api_key}

Answer

extra_vars: {MY_API_KEY: "{{ api_key }}"}

Question 5

A junior admin is troubleshooting why a job template fails with 'Permission denied' when connecting to a target host. The job template uses a machine credential that appears correct. What is the first thing to check?

Accepted Answer

Check the credential's username and private key / password. The error 'Permission denied' during SSH connection to a target host indicates an authentication failure. Since the machine credential appears correct, the most immediate cause is that the username or private key/password stored in the credential is incorrect or mismatched. This is the first thing to check because the credential directly controls authentication to the target host.

Answer

Verify the inventory contains the correct host IP

Answer

Check the vault credential used in the job template

Answer

Check the project sync status

Question 6

Which TWO of the following are valid methods to supply a credential password in Ansible Automation Controller?

Accepted Answer

Prompt on launch (ask for credential on job run). Option A is correct because Ansible Automation Controller allows credentials to be prompted on launch, meaning the user is asked to enter the password at runtime rather than storing it. This is a secure method for sensitive values that should not be persisted in the controller's database or any configuration file.

Answer

Set the password via an environment variable in the job template

Answer

Include the password in a file in the project repository

Answer

Store the password in plain text in the credential definition

Question 7

Which THREE of the following are best practices for managing credentials in Ansible Automation Controller?

Accepted Answer

Restrict credential 'Use' permissions to specific users or teams. Option C is correct because Ansible Automation Controller's Role-Based Access Control (RBAC) allows administrators to assign granular 'Use' permissions to specific users or teams, ensuring that only authorized entities can leverage a credential for job runs. This prevents unauthorized access to sensitive secrets and aligns with the principle of least privilege, which is a core security best practice in automation environments.

Answer

Avoid using external secret management systems; keep all secrets in Automation Controller

Answer

Share the same credential across multiple organizations for simplicity

Question 8

The inventory above is used in a job template in Automation Controller. The job template also has a machine credential assigned that specifies username 'root' and an SSH key. When the job runs against host web1, which username will Ansible use to connect?

Accepted Answer

admin (from inventory host variable). Option A is correct because Ansible uses a specific precedence order for determining the connection user. When a host variable (like `ansible_user: admin`) is defined in the inventory for host web1, it overrides the username set in the job template's machine credential. The credential's username ('root') acts only as a fallback if no `ansible_user` is defined at the host or group level.

Answer

The username set in the job template's 'extra variables'

Answer

The first defined username in the credential chain

Answer

root (from credential)

Question 9

The job template running against host db1 uses a machine credential with an SSH key. The key is correctly configured in Automation Controller. However, the job fails with the error shown. What is the most likely cause?

Accepted Answer

The SSH public key corresponding to the private key is not installed on the target host. The error indicates that Automation Controller cannot authenticate to host db1 using the SSH key. Since the key is correctly configured in the controller, the most likely cause is that the corresponding public key is not present in the target host's ~/.ssh/authorized_keys file. SSH key-based authentication requires the private key on the client (controller) and the public key installed on the target host; without the public key, the server rejects the connection attempt.

Answer

The vault password is incorrect

Answer

The SSH port is blocked by a firewall

Answer

The host's SSH host key has changed and the known_hosts file is outdated

Question 10

A company uses Ansible Automation Controller to manage a mix of Linux and Windows servers. Each server is in a separate inventory group. The Linux servers use SSH keys stored in machine credentials, and the Windows servers use username/password stored in machine credentials. Recently, a new security policy requires that all credentials must be rotated every 90 days. The automation team has 50 Linux servers and 20 Windows servers. They want to minimize manual effort and avoid exposing secrets in plain text during rotation. They currently have a Jenkins pipeline that can run scripts on the controller node. Which approach best meets the requirements?

Accepted Answer

Write a script that uses the Automation Controller API to update the credential's inputs (e.g., new SSH key or password) after rotating them on the target servers. Option B is correct because it uses the Automation Controller API to programmatically update credential inputs (SSH keys or passwords) after rotating them on the target servers, which minimizes manual effort, avoids exposing secrets in plain text (the API call uses HTTPS and authentication tokens), and satisfies the 90-day rotation policy. The Jenkins pipeline can invoke a script that first rotates the secret on each server (e.g., via SSH or WinRM) and then calls the API's PATCH endpoint for the credential to update the stored value, ensuring the credential remains synchronized without manual UI intervention.

Answer

Use a Vault credential to store the new secrets and reference them in the job template

Answer

Store the new passwords directly in a playbook and run it manually on each server, then update the credential in the UI

Answer

Create a single machine credential with the same SSH key for all Linux servers and a single credential for all Windows servers